* [PATCH 0/3] wifi: NULL terminate some user strings
@ 2026-10-01 7:37 Dan Carpenter
2026-10-01 7:37 ` [PATCH 1/3] wifi: b43: don't pass unterminated string to sscanf() Dan Carpenter
2026-10-01 7:37 ` [PATCH 2/3] wifi: b43legacy: debugfs: NUL terminate string in debugfs Dan Carpenter
0 siblings, 2 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-10-01 7:37 UTC (permalink / raw)
To: linux-wireless
Cc: Christian Lamparter, b43-dev, David S. Miller, linux-wireless
These strings come from the user and they need to be NUL terminated.
Dan Carpenter (3):
wifi: b43: don't pass unterminated string to sscanf()
wifi: b43legacy: debugfs: NUL terminate string in debugfs
wifi: carl9170: NUL terminate string in debugfs
drivers/net/wireless/ath/carl9170/debug.c | 5 +++--
drivers/net/wireless/broadcom/b43/debugfs.c | 2 +-
drivers/net/wireless/broadcom/b43legacy/debugfs.c | 2 +-
3 files changed, 5 insertions(+), 4 deletions(-)
--
2.53.0
_______________________________________________
b43-dev mailing list
b43-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/b43-dev
^ permalink raw reply [flat|nested] 3+ messages in thread
* [PATCH 1/3] wifi: b43: don't pass unterminated string to sscanf()
2026-10-01 7:37 [PATCH 0/3] wifi: NULL terminate some user strings Dan Carpenter
@ 2026-10-01 7:37 ` Dan Carpenter
2026-10-01 7:37 ` [PATCH 2/3] wifi: b43legacy: debugfs: NUL terminate string in debugfs Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-10-01 7:37 UTC (permalink / raw)
To: b43-dev; +Cc: David S. Miller, linux-wireless, b43-dev
The "buf" buffer is a PAGE_SIZE and allocated with kzalloc(). We store
a string from the user in it and then pass it to sscanf() in the write
functions such as shm32write__write_file(). Only a few numbers are
stored in the buffer so it never comes close to filling up the whole
PAGE_SIZE. Reserve the last character of the page for a NUL terminator.
This is debugfs so it's root only.
Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/net/wireless/broadcom/b43/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/b43/debugfs.c b/drivers/net/wireless/broadcom/b43/debugfs.c
index 31a1ff00c1a4..173ef5db90fc 100644
--- a/drivers/net/wireless/broadcom/b43/debugfs.c
+++ b/drivers/net/wireless/broadcom/b43/debugfs.c
@@ -557,7 +557,7 @@ static ssize_t b43_debugfs_write(struct file *file,
if (!count)
return 0;
- if (count > PAGE_SIZE)
+ if (count >= PAGE_SIZE)
return -E2BIG;
dev = file->private_data;
if (!dev)
--
2.53.0
_______________________________________________
b43-dev mailing list
b43-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/b43-dev
^ permalink raw reply related [flat|nested] 3+ messages in thread
* [PATCH 2/3] wifi: b43legacy: debugfs: NUL terminate string in debugfs
2026-10-01 7:37 [PATCH 0/3] wifi: NULL terminate some user strings Dan Carpenter
2026-10-01 7:37 ` [PATCH 1/3] wifi: b43: don't pass unterminated string to sscanf() Dan Carpenter
@ 2026-10-01 7:37 ` Dan Carpenter
1 sibling, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2026-10-01 7:37 UTC (permalink / raw)
To: b43-dev; +Cc: David S. Miller, linux-wireless
The "buf" buffer is PAGE_SIZE and allocated with kzalloc(). We store a
string from the user in it and then pass it to sscanf() in the write
functions such as tsf_write_file(). The buffer is only used to store a
number so we never come close to filling up the whole PAGE_SIZE. Reserve
the last character of the page for a NUL terminator.
This is debugfs so it's root only.
Fixes: 75388acd0cd8 ("[B43LEGACY]: add mac80211-based driver for legacy BCM43xx devices")
Signed-off-by: Dan Carpenter <error27@gmail.com>
---
drivers/net/wireless/broadcom/b43legacy/debugfs.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/net/wireless/broadcom/b43legacy/debugfs.c b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
index a04d90d7307c..7ce8bcf12f0a 100644
--- a/drivers/net/wireless/broadcom/b43legacy/debugfs.c
+++ b/drivers/net/wireless/broadcom/b43legacy/debugfs.c
@@ -259,7 +259,7 @@ static ssize_t b43legacy_debugfs_write(struct file *file,
if (!count)
return 0;
- if (count > PAGE_SIZE)
+ if (count >= PAGE_SIZE)
return -E2BIG;
dev = file->private_data;
if (!dev)
--
2.53.0
_______________________________________________
b43-dev mailing list
b43-dev@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/b43-dev
^ permalink raw reply related [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-10-01 7:37 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-10-01 7:37 [PATCH 0/3] wifi: NULL terminate some user strings Dan Carpenter
2026-10-01 7:37 ` [PATCH 1/3] wifi: b43: don't pass unterminated string to sscanf() Dan Carpenter
2026-10-01 7:37 ` [PATCH 2/3] wifi: b43legacy: debugfs: NUL terminate string in debugfs Dan Carpenter
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox